Microsoft Internet Explorer 11 MSHTML CMapElement::Notify Use-After-Free
Posted by deepcore on November 15, 2016 – 2:28 am
A specially crafted web-page can cause MSIE 11 to interrupt the handling of one readystatechange event with another. This interrupts a call to one of the various CElement::Notify functions to make another such call and at least one of these functions is non-reentrant. This can have various repercussions, e.g. when an attacker triggers this vulnerability using a CMapElement object, a reference to that object can be stored in a linked list and the object itself can be freed. This pointer can later be re-used to cause a classic use-after-free issue.
Post a reply
You must be logged in to post a comment.